ASP.NET Core 5 MVC对接Identity Server4应选哪种OpenId授权类型？

Great question! Let’s break this down based on your MVC app’s core requirements—since the right flow depends entirely on whether you need to access the API on behalf of a logged-in user or as the application itself (no user context).

1. Use Authorization Code Flow if you need user context #

Yes, you absolutely can use the Authorization Code Flow just like your Angular app—and it’s even more secure for MVC because your client secret stays safely on the server (no exposure to a browser). This flow is perfect when your MVC app needs to call the API with permissions tied to the currently logged-in user (e.g., fetching the user’s personal data, checking their role-based access).

How to implement it with IdentityModel #

First, configure authentication in your MVC app’s Startup.cs (or Program.cs if using top-level statements):

services.AddAuthentication(options =>
{
    options.DefaultScheme = "Cookies";
    options.DefaultChallengeScheme = "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect("oidc", options =>
{
    options.Authority = "https://your-identity-server-url";
    options.ClientId = "mvc-client-id";
    options.ClientSecret = "your-mvc-client-secret";
    options.ResponseType = "code"; // Explicitly use authorization code flow
    options.Scope.Add("your-api-scope"); // Add the scope your API requires
    options.SaveTokens = true; // Saves access/refresh tokens in the auth cookie
});

// Add token management to handle automatic token refresh
services.AddAccessTokenManagement();

Then, when calling your API, use the token management services to fetch and attach the access token:

private readonly IHttpClientFactory _httpClientFactory;
private readonly IAccessTokenManagementService _tokenService;

public MyApiController(IHttpClientFactory httpClientFactory, IAccessTokenManagementService tokenService)
{
    _httpClientFactory = httpClientFactory;
    _tokenService = tokenService;
}

public async Task<IActionResult> FetchUserSpecificData()
{
    var apiClient = _httpClientFactory.CreateClient();
    var accessToken = await _tokenService.GetAccessTokenAsync("oidc");
    
    apiClient.SetBearerToken(accessToken);
    var response = await apiClient.GetAsync("https://your-api-url/api/user/data");
    
    response.EnsureSuccessStatusCode();
    var data = await response.Content.ReadAsStringAsync();
    
    return View(model: data);
}

2. Use Client Credentials Flow if you don’t need user context #

If your MVC app needs to call the API without tying the request to a specific user (e.g., fetching public data, running background tasks, or accessing app-level resources), the Client Credentials Flow is the better choice. It’s simpler, faster, and doesn’t require user login.

How to implement it with IdentityModel #

Configure a named HTTP client with automatic token handling in Startup.cs:

services.AddHttpClient("api-client", client =>
{
    client.BaseAddress = new Uri("https://your-api-url/");
})
.AddClientCredentialsTokenHandler(options =>
{
    options.Authority = "https://your-identity-server-url";
    options.ClientId = "mvc-client-id";
    options.ClientSecret = "your-mvc-client-secret";
    options.Scope.Add("your-api-scope");
});

Then call the API directly—no user login required:

private readonly IHttpClientFactory _httpClientFactory;

public PublicDataController(IHttpClientFactory httpClientFactory)
{
    _httpClientFactory = httpClientFactory;
}

public async Task<IActionResult> FetchPublicData()
{
    var apiClient = _httpClientFactory.CreateClient("api-client");
    var response = await apiClient.GetAsync("api/public/data");
    
    response.EnsureSuccessStatusCode();
    var data = await response.Content.ReadAsStringAsync();
    
    return View(model: data);
}

Quick Decision Checklist #

• Do you need to pass user identity/permissions to the API? Use Authorization Code Flow
• Are you accessing API resources that don’t belong to a specific user? Use Client Credentials Flow

内容的提问来源于stack exchange，提问作者Miguel Moura